From 05565be8fdd79d641aa22b7b7a686dd68f158ce8 Mon Sep 17 00:00:00 2001 From: Laszlo Ersek Date: Wed, 13 Feb 2019 22:06:28 +0100 Subject: [PATCH 13/13] Upgrade OpenSSL to 1.1.0j RH-Author: Laszlo Ersek Message-id: <20190213225928.17791-5-lersek@redhat.com> Patchwork-id: 84502 O-Subject: [RHEL-7.7 ovmf PATCH 4/4] Upgrade OpenSSL to 1.1.0j Bugzilla: 1650390 RH-Acked-by: Thomas Huth RH-Acked-by: Miroslav Rezanina --v-- RHEL7 note start --v-- (1) NOTE: this is a partial cherry-pick. We're only advancing to 1.1.0i. The upstream commit advanced the OpenSSL git submodule from upstream OpenSSL commit d4e4bd2a8163 ("Prepare for 1.1.0h release", 2018-03-27) to upstream OpenSSL commit 74f2d9c1ec5f ("Prepare for 1.1.0j release", 2018-11-20). Meaning, upstream edk2 skipped 1.1.0i. However, Fedora 28 only offers 1.1.0i at this point (and it will not be rebased again until 1.1.0k is released). Therefore hunks in the upstream CryptoPkg commit that relate specifically to 1.1.0j have to be dropped from the backport. The only such hunks are the "crypto/getenv.c" additions to the INF files. The related upstream OpenSSL change was commit 1abdf08284af ("Use secure_getenv(3) when available.", 2018-09-24), part of tag "OpenSSL_1_1_0j". The other hunks all relate to OpenSSL commits present in tag "OpenSSL_1_1_0i" -- hence we keep those hunks: * 23dec58b9c2e ("Move the loading of the ssl_conf module to libcrypto", 2018-04-05) This justifies the addition of "crypto/conf/conf_ssl.c" to the INF files. * 6912debb881e ("Add APIs for custom X509_LOOKUP_METHOD creation", 2018-05-30) This justifies the addition of "crypto/x509/x509_meth.c" to the INF files. * dcb8333087d5 ("Avoid __GNUC__ warnings when defining DECLARE_DEPRECATED", 2018-07-11) This justifies the ifdeffery update in "opensslconf.h". (2) After this downstream patch, the affected files almost match their upstream counterparts at commit a18f784cfdbe (i.e., at the commit being cherry-picked). What's missing (beyond the above 1.1.0j-specific hunks) belong to the following upstream commits, which we don't need: * 630f67ddfea2 ("CryptoPkg: Clean up source files", 2018-06-28), * 94d67262d891 ("CryptoPkg: Removing ipf which is no longer supported from edk2.", 2018-09-25) (IPF stands for Itanium.) --^-- RHEL7 note end --^-- REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1393 BZ#1089 (https://bugzilla.tianocore.org/show_bug.cgi?id=1089) requests to upgrade the OpenSSL to the latest 1.1.1 release. Since OpenSSL-1.1.1 has many changes, more porting efforts and feature evaluation are needed. This might lead to a situation that it cannot catch the Q1'19 stable tag. One of the solution is upgrade current version (1.1.0h) to 1.1.0j. According to following web page in openssl.org, all security issues solved in 1.1.1 have been also back-ported to 1.1.0.j. This can make sure that no security vulnerabilities left in edk2 master before 1.1.1. https://www.openssl.org/news/vulnerabilities-1.1.1.html Cc: Ting Ye Cc: Gang Wei Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jian J Wang Reviewed-by: Gang Wei Reviewed-by: Ting Ye (cherry picked from commit a18f784cfdbe17855ec4376e80db927e1a81aaca) --- CryptoPkg/CryptoPkg.dsc | 1 + CryptoPkg/Library/Include/openssl/opensslconf.h | 20 +++++++++++++------- CryptoPkg/Library/OpensslLib/OpensslLib.inf | 2 ++ CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 2 ++ CryptoPkg/Library/OpensslLib/process_files.pl | 0 5 files changed, 18 insertions(+), 7 deletions(-) mode change 100644 => 100755 CryptoPkg/Library/OpensslLib/process_files.pl diff --git a/CryptoPkg/CryptoPkg.dsc b/CryptoPkg/CryptoPkg.dsc index b49e587..f305f95 100644 --- a/CryptoPkg/CryptoPkg.dsc +++ b/CryptoPkg/CryptoPkg.dsc @@ -124,6 +124,7 @@ CryptoPkg/Library/BaseCryptLib/PeiCryptLib.inf CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf CryptoPkg/Library/TlsLib/TlsLib.inf + CryptoPkg/Library/OpensslLib/OpensslLib.inf CryptoPkg/CryptRuntimeDxe/CryptRuntimeDxe.inf diff --git a/CryptoPkg/Library/Include/openssl/opensslconf.h b/CryptoPkg/Library/Include/openssl/opensslconf.h index 1917d7a..28dd9ab 100644 --- a/CryptoPkg/Library/Include/openssl/opensslconf.h +++ b/CryptoPkg/Library/Include/openssl/opensslconf.h @@ -2,7 +2,7 @@ * WARNING: do not edit! * Generated from include/openssl/opensslconf.h.in * - * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -235,12 +235,18 @@ extern "C" { * still won't see them if the library has been built to disable deprecated * functions. */ -#if defined(OPENSSL_NO_DEPRECATED) -# define DECLARE_DEPRECATED(f) -#elif __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) -# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); -#else -# define DECLARE_DEPRECATED(f) f; +#ifndef DECLARE_DEPRECATED +# if defined(OPENSSL_NO_DEPRECATED) +# define DECLARE_DEPRECATED(f) +# else +# define DECLARE_DEPRECATED(f) f; +# ifdef __GNUC__ +# if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ > 0) +# undef DECLARE_DEPRECATED +# define DECLARE_DEPRECATED(f) f __attribute__ ((deprecated)); +# endif +# endif +# endif #endif #ifndef OPENSSL_FILE diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf index 55a6fa3..b44510d 100644 --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf @@ -175,6 +175,7 @@ $(OPENSSL_PATH)/crypto/conf/conf_mall.c $(OPENSSL_PATH)/crypto/conf/conf_mod.c $(OPENSSL_PATH)/crypto/conf/conf_sap.c + $(OPENSSL_PATH)/crypto/conf/conf_ssl.c $(OPENSSL_PATH)/crypto/cpt_err.c $(OPENSSL_PATH)/crypto/cryptlib.c $(OPENSSL_PATH)/crypto/cversion.c @@ -418,6 +419,7 @@ $(OPENSSL_PATH)/crypto/x509/x509_err.c $(OPENSSL_PATH)/crypto/x509/x509_ext.c $(OPENSSL_PATH)/crypto/x509/x509_lu.c + $(OPENSSL_PATH)/crypto/x509/x509_meth.c $(OPENSSL_PATH)/crypto/x509/x509_obj.c $(OPENSSL_PATH)/crypto/x509/x509_r2x.c $(OPENSSL_PATH)/crypto/x509/x509_req.c diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf index f542998..46217cc 100644 --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf @@ -175,6 +175,7 @@ $(OPENSSL_PATH)/crypto/conf/conf_mall.c $(OPENSSL_PATH)/crypto/conf/conf_mod.c $(OPENSSL_PATH)/crypto/conf/conf_sap.c + $(OPENSSL_PATH)/crypto/conf/conf_ssl.c $(OPENSSL_PATH)/crypto/cpt_err.c $(OPENSSL_PATH)/crypto/cryptlib.c $(OPENSSL_PATH)/crypto/cversion.c @@ -418,6 +419,7 @@ $(OPENSSL_PATH)/crypto/x509/x509_err.c $(OPENSSL_PATH)/crypto/x509/x509_ext.c $(OPENSSL_PATH)/crypto/x509/x509_lu.c + $(OPENSSL_PATH)/crypto/x509/x509_meth.c $(OPENSSL_PATH)/crypto/x509/x509_obj.c $(OPENSSL_PATH)/crypto/x509/x509_r2x.c $(OPENSSL_PATH)/crypto/x509/x509_req.c diff --git a/CryptoPkg/Library/OpensslLib/process_files.pl b/CryptoPkg/Library/OpensslLib/process_files.pl old mode 100644 new mode 100755 -- 1.8.3.1